This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Server side SMTP blocking

Hi Everyone,

I am currently in the process of trailing Sophos Endpoint secuity for our company. So far, it has excedeed my expectations. Just one point of interest i thought i would engage you on and get your opinions.

We have been for years, using McAfee, which has the capability to block outgoing SMTP (port 25) connections. Sophos Client Firewall has this option which has been tried and works great. However, we also have been blocking SMTP on our server systems, with the exception of select processes. Sophos does not provide a server side firewall to do this.

Wondering if anyone else sees the point to continuing blocking this. Or if anyone else is doign this, how is this being accomplished?

This thread was automatically locked due to age.

Parents

0 jak over 13 years ago

Hi,
I suspect that if a malicious process was going to try and spam out something, depending on the characteristics of the file and runtime it would probably be picked up by HIPS as an IPConnect rule.
http://www.sophos.com/en-us/threat-center/threat-analyses/suspicious-behavior-and-files/HIPS~IPConnect-001/detailed-analysis.aspx
http://www.sophos.com/en-us/threat-center/threat-analyses/suspicious-behavior-and-files/HIPS~IPConnect-002/detailed-analysis.aspx
http://www.sophos.com/en-us/threat-center/threat-analyses/suspicious-behavior-and-files/HIPS~IPConnect-003/detailed-analysis.aspx
http://www.sophos.com/en-us/threat-center/threat-analyses/suspicious-behavior-and-files/HIPS~IPConnect-004/detailed-analysis.aspx
and that's if it wasn't picked up as something else.
What about just using the Windows firewall or even TCP/IP filtering: http://support.microsoft.com/kb/816792 to block outgoing 25, even if it doesn't have application level inspection that would be something for the servers where you can't run SCF.
Regards,
Jak
:27057
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 jak over 13 years ago

Hi,
I suspect that if a malicious process was going to try and spam out something, depending on the characteristics of the file and runtime it would probably be picked up by HIPS as an IPConnect rule.
http://www.sophos.com/en-us/threat-center/threat-analyses/suspicious-behavior-and-files/HIPS~IPConnect-001/detailed-analysis.aspx
http://www.sophos.com/en-us/threat-center/threat-analyses/suspicious-behavior-and-files/HIPS~IPConnect-002/detailed-analysis.aspx
http://www.sophos.com/en-us/threat-center/threat-analyses/suspicious-behavior-and-files/HIPS~IPConnect-003/detailed-analysis.aspx
http://www.sophos.com/en-us/threat-center/threat-analyses/suspicious-behavior-and-files/HIPS~IPConnect-004/detailed-analysis.aspx
and that's if it wasn't picked up as something else.
What about just using the Windows firewall or even TCP/IP filtering: http://support.microsoft.com/kb/816792 to block outgoing 25, even if it doesn't have application level inspection that would be something for the servers where you can't run SCF.
Regards,
Jak
:27057
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data